@fougere/core 0.17.4-alpha.0 → 0.19.0-alpha.0

package/src/boot/Emissions.ts

@@ -172,8 +172,16 @@ export class Emissions {
     return (this.subscribers.get(fact) ?? []).map(({ facade }) => facade);
   }
 
+  /**
+   * What a listener is handed a fact through: the calls a door makes, never the facade code
+   * holds. A fact arrives as the invocation's input and the listener's binding plan places it,
+   * wherever it sits in the signature.
+   */
+  private calls: (facade: string) => Record<string, Function> | undefined = () => undefined;
+
   /** Register one emission value per fact — announced here, or merely listened to. */
-  register(): void {
+  register(calls: (facade: string) => Record<string, Function> | undefined): void {
+    this.calls = calls;
     this.orderPipes();
     for (const fact of new Set([...this.announced, ...this.subscribers.keys()])) {
       this.container.registerValue(emitKeyOf(fact), (raw: unknown) => this.announce(fact, raw));
@@ -295,8 +303,7 @@ export class Emissions {
   private async finished(fact: string, payload: unknown): Promise<unknown> {
     let carried = payload;
     for (const link of this.pipes.get(fact) ?? []) {
-      const facade = this.container.resolve<Record<string, Function>>(link.facade);
-      const answered = await facade[link.op]({ ...Invocation.empty, input: carried });
+      const answered = await this.reach(link.facade, fact)[link.op]({ ...Invocation.empty, input: carried });
 
       // A link that answers nothing SUPPRESSES the fact — every subscriber was then handed
       // `null` and crashed reading it, one message each. It is refused rather than named,
@@ -377,18 +384,18 @@ export class Emissions {
       facade,
       op,
       done: ambient.enterChain(fact, async () => {
-        let handler: Record<string, Function>;
-        try {
-          handler = this.container.resolve<Record<string, Function>>(facade);
-        } catch (cause) {
-          throw new Error(`${fact} → ${facade} could not be reached`, { cause });
-        }
-
-        return handler[op]({ ...Invocation.empty, input: payload });
+        return this.reach(facade, fact)[op]({ ...Invocation.empty, input: payload });
       }),
     }));
   }
 
+  private reach(facade: string, fact: string): Record<string, Function> {
+    const calls = this.calls(facade);
+    if (!calls) throw new Error(`${fact} → ${facade} could not be reached`);
+
+    return calls;
+  }
+
   /** A subscriber refusing the SHAPE, said in one line instead of dumped as an error. */
   private describeRefusal(fact: string, cause: unknown): string | undefined {
     const refusals = validationErrorsOf(cause);

package/src/boot/bootstrap.ts

@@ -57,7 +57,8 @@ import { LocalRoutePolicy } from '../dispatch/LocalRoutePolicy.js';
 import { OperationRoute } from '../dispatch/OperationRoute.js';
 import { remoteRoutes } from '../dispatch/remoteRoutes.js';
 import { RouteRegistry } from '../dispatch/RouteRegistry.js';
-import { facadeOperations } from '../entry/facade.js';
+import { callOperations, facadeOperations } from '../entry/facade.js';
+import { decoded } from '../dispatch/decoded.js';
 
 const LOG_LINE = lowerFirst(LogLine.name);
 
@@ -403,6 +404,7 @@ interface Serving {
   container: Container;
   fronds: Fronds;
   remoteRouter: RemoteRouter | undefined;
+  dispatcher: Dispatcher;
   localDispatcher: Dispatcher;
   routeRegistry: RouteRegistry;
   effectiveByKey: Map<string, EffectiveOperationsMap>;
@@ -415,7 +417,7 @@ interface Serving {
  * `facadeFor` is THE rule, stated once: every projection reads it and nothing else.
  */
 function readings(
-  { container, fronds, remoteRouter, localDispatcher, routeRegistry, effectiveByKey, log }: Serving,
+  { container, fronds, remoteRouter, dispatcher, localDispatcher, routeRegistry, effectiveByKey, log }: Serving,
 ): Pick<App, 'resolve' | 'schemaFor' | 'facadeFor' | 'operationsFor' | 'presenterFor'> {
   const resolve = <T>(name: string): T => {
     try {
@@ -454,6 +456,19 @@ function readings(
     }
   };
 
+  /**
+   * What a door is handed for an address it may serve: the calls, not the facade code holds.
+   * The names are the routes this process registered; an address served elsewhere has none
+   * before it is reached, so its calls are named when they are made.
+   */
+  const callsAt = (address: string, surface: string | undefined, through: Dispatcher): Record<string, Function> => {
+    const names = routeRegistry.operationNames(address, surface);
+    if (names.length === 0) return callOperations(through, address, undefined, surface);
+    const effective = effectiveByKey.get(facadeKeyOf(address, surface));
+
+    return callOperations(through, address, names, surface, (operation, answer) => decoded(effective?.get(operation)?.output, answer));
+  };
+
   /** Said once per pair, so a facade that registers in a loop says it once. */
   const saidAbsent = new Set<string>();
 
@@ -474,9 +489,9 @@ function readings(
 
   /** THE membership rule, stated once — every projection reads this and nothing else. */
   const facadeFor = (address: string, surface?: string): Record<string, Function> | undefined => {
-    if (!surface) return facadeAt(facadeKeyOf(address), true);
+    if (!surface) return facadeAt(facadeKeyOf(address), true) && callsAt(address, undefined, dispatcher);
 
-    const own = facadeAt(facadeKeyOf(address, surface), false);
+    const own = facadeAt(facadeKeyOf(address, surface), false) && callsAt(address, surface, localDispatcher);
     if (!fronds.owner(address)) {
       sayNoSurfaceAcross(address, surface);
 
@@ -490,7 +505,7 @@ function readings(
     const fallback = facadeAt(facadeKeyOf(address), false);
 
     return fallback
-      ? facadeOperations(
+      ? callOperations(
           localDispatcher,
           address,
           routeRegistry.operationNames(address, surface),
@@ -574,7 +589,7 @@ function answerRemotes(
   { container, routeRegistry, dispatcher, getMiddlewares, options, state }: Pick<Assembly, 'container' | 'routeRegistry' | 'dispatcher' | 'getMiddlewares' | 'options' | 'state'>,
   remoteRouter: RemoteRouter,
   fronds: Fronds,
-): void {
+): (name: string) => boolean {
   // Only for what another process may serve: an entity a frond hosts HERE and gives no handler
   // is served by nobody, and a stand-in for it had GraphQL project an entity with no operation.
   const servedElsewhere = (address: string): boolean => {
@@ -582,9 +597,8 @@ function answerRemotes(
 
     return owner === undefined || owner.name in (options.remotes ?? {});
   };
-  container.setFallback((name) => (isFacadeKey(name) && servedElsewhere(addressOf(name))
-    ? facadeOperations(dispatcher, addressOf(name))
-    : undefined));
+  const answeredElsewhere = (name: string): boolean => isFacadeKey(name) && servedElsewhere(addressOf(name));
+  container.setFallback((name) => (answeredElsewhere(name) ? facadeOperations(dispatcher, addressOf(name)) : undefined));
 
   const remoteFacades = new Map<string, Record<string, Function>>();
   routeRegistry.addResolver(remoteRoutes((address) => {
@@ -595,6 +609,8 @@ function answerRemotes(
 
     return facade;
   }));
+
+  return answeredElsewhere;
 }
 
 /** Refused rather than replaced: two declarations of one name would make the answer depend on wiring order. */
@@ -695,16 +711,16 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     refuseWhatDoesNotHold(refused);
     warnAboutUnboundPorts(options, boundPorts, log);
 
+    const { resolve, schemaFor, facadeFor, operationsFor, presenterFor } = readings({
+      container, fronds, remoteRouter, dispatcher, localDispatcher, routeRegistry, effectiveByKey, log,
+    });
+
     // A pipe order and an `Emit<T, A>` are read here, once every facade exists.
-    emissions.register();
+    emissions.register((facade) => facadeFor(addressOf(facade)));
     refuseWhatDoesNotHold(refused);
     markLineCarriers(emissions);
 
-    if (remoteRouter) answerRemotes(assembly, remoteRouter, fronds);
-
-    const { resolve, schemaFor, facadeFor, operationsFor, presenterFor } = readings({
-      container, fronds, remoteRouter, localDispatcher, routeRegistry, effectiveByKey, log,
-    });
+    const answeredElsewhere = remoteRouter ? answerRemotes(assembly, remoteRouter, fronds) : () => false;
 
     const app: App = {
       container,
@@ -741,7 +757,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
     built = app;
     await appLifecycle.up(app);
-    refuseWhatDoesNotHold(unregistered(container, fronds));
+    refuseWhatDoesNotHold(unregistered(container, fronds, answeredElsewhere));
     stopAnnouncing = announceLines(emissions, container, carry);
 
     return app;

package/src/boot/card.ts

@@ -2,12 +2,11 @@
 import { Card } from '@fougere/schema';
 import type { App } from './App.js';
 import { factsAnnouncedBy } from '../wire/Emit.js';
-import type { InvocationContext } from '../wire/InvocationContext.js';
 import { type CardOp } from '../wire/card/CardOp.js';
 import { type IdentityCard } from '../wire/card/IdentityCard.js';
 import { facadeKeyOf } from '../wire/Facade.js';
 
-type AnyFacade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
+type AnyFacade = Record<string, (...args: unknown[]) => Promise<unknown>>;
 
 /** Serialize what the app hosts, for one audience. */
 export function identityCardOf(app: App, surface?: string): IdentityCard {

package/src/boot/install.ts

@@ -434,6 +434,7 @@ function buildFacadeInto(
     frond: frond.name,
     handlers: frond.handlers,
     operations: operationModel.forHandler(handler),
+    entities: (name) => assembly.entityByName.get(lowerFirst(name)),
     collectors: collectorTypeNames,
     presenter: presenterMap.get(handler.address),
     presenterScope: scope,

package/src/boot/ownership.ts

@@ -4,7 +4,7 @@ import { type ProviderEntry } from '../descriptor/ProviderEntry.js';
 import { inheritsCrud } from '../prefab/CrudConstructor.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownedBy, repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
-import { entityOfStorageKey } from '../storage/Storage.js';
+import { entityOfStorageKey, membersOfTogetherKey } from '../storage/Storage.js';
 import type { Diagnostic } from '../diagnostic.js';
 
 /** One name, one file: two providers under one key and the second silently replaces the first. */
@@ -129,23 +129,16 @@ function refuseStorageReached(
   const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
 
   for (const dep of decl.deps) {
-    const entity = entityOfStorageKey(dep, known);
-    if (!entity) continue;
-
-    const owner = owners.get(entity);
-    if (owner && owner !== decl.ctor.name) {
-      refused.push({
-        severity: 'blocking',
-        code: 'aggregate-storage-reached',
-        filePath: decl.filePath,
-        frond,
-        subject: `${decl.ctor.name}(${dep})`,
-        message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
-          + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
-          + `constructor(private ${entity}: ${owner}) {}`,
-      });
+    const framed = membersOfTogetherKey(dep);
+    if (framed) {
+      const members = framed.entities.map(lowerFirst).filter(known);
+      for (const entity of members) reachesOwned(decl, dep, entity, frond, owners, refused);
       continue;
     }
+
+    const entity = entityOfStorageKey(dep, known);
+    if (!entity) continue;
+    if (reachesOwned(decl, dep, entity, frond, owners, refused)) continue;
     if (allowed.includes(entity)) continue;
 
     refused.push({
@@ -162,6 +155,32 @@ function refuseStorageReached(
   }
 }
 
+/** Whether `dep` reaches an entity an aggregate other than `decl` owns — a frame as much as a storage. */
+function reachesOwned(
+  decl: { ctor: { name: string }; filePath: string },
+  dep: string,
+  entity: string,
+  frond: string,
+  owners: Map<string, string>,
+  refused: Diagnostic[],
+): boolean {
+  const owner = owners.get(entity);
+  if (!owner || owner === decl.ctor.name) return false;
+
+  refused.push({
+    severity: 'blocking',
+    code: 'aggregate-storage-reached',
+    filePath: decl.filePath,
+    frond,
+    subject: `${decl.ctor.name}(${dep})`,
+    message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
+      + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
+      + `constructor(private ${entity}: ${owner}) {}`,
+  });
+
+  return true;
+}
+
 export function storageInUserCode(
   frond: FrondDescriptor,
   owners: Map<string, string>,

package/src/boot/unregistered.ts

@@ -1,42 +1,40 @@
 import type { Container } from '@fougere/container';
 import type { Diagnostic } from '../diagnostic.js';
 import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
-
-type Declared = { frond: string; filePath: string };
-
-/** Every class a frond hands the container, by identity — the one key a bundler cannot rename. */
-function declaredBy(fronds: readonly FrondDescriptor[]): Map<Function, Declared> {
-  const declared = new Map<Function, Declared>();
-  for (const frond of fronds) {
-    const entries = [...frond.handlers, ...frond.providers, ...frond.presenters, ...frond.collectors, ...frond.middlewares];
-    for (const { ctor, filePath } of entries) declared.set(ctor, { frond: frond.name, filePath });
-  }
-
-  return declared;
-}
+import { SEAMS } from './ports.js';
 
 /**
  * What a constructor asks for and nothing where it is built answers — refused at boot rather than
- * at its first call, once the extensions have risen, since `up` registers too.
+ * at its first call, once the extensions have risen, since `up` registers too. Read off what each
+ * class DECLARES, in the scope of the frond that declares it. A seam is answered by the link that
+ * wraps it, and a facade another process serves by the stand-in `answeredElsewhere` names.
  */
-export function unregistered(container: Container, fronds: readonly FrondDescriptor[]): Diagnostic[] {
-  const declared = declaredBy(fronds);
-  const seen = new Set<string>();
-
-  return container.unresolved().flatMap(({ ctor, missing }) => {
-    const subject = ctor.name;
-    if (seen.has(`${subject}→${missing}`)) return [];
-    seen.add(`${subject}→${missing}`);
-    const where = declared.get(ctor);
+export function unregistered(
+  container: Container,
+  fronds: readonly FrondDescriptor[],
+  answeredElsewhere: (name: string) => boolean,
+): Diagnostic[] {
+  const refused = new Map<string, Diagnostic>();
+  for (const frond of fronds) {
+    if (!container.has(`frond:${frond.name}`)) continue;
+    const scope = container.resolve<Container>(`frond:${frond.name}`);
+    const declared = [...frond.handlers, ...frond.providers, ...frond.presenters, ...frond.collectors, ...frond.middlewares];
+    for (const { ctor, deps, filePath } of declared) {
+      for (const missing of deps) {
+        if (scope.has(missing) || SEAMS.has(missing) || answeredElsewhere(missing)) continue;
+        if (refused.has(`${ctor.name}→${missing}`)) continue;
+        refused.set(`${ctor.name}→${missing}`, {
+          severity: 'blocking',
+          code: 'dependency-unregistered',
+          frond: frond.name,
+          subject: ctor.name,
+          filePath,
+          message: `${ctor.name} asks for ${missing}, and nothing in frond '${frond.name}' or above it answers that name. `
+            + `A class of that name in a convention directory, or one extending it, would.`,
+        });
+      }
+    }
+  }
 
-    return [{
-      severity: 'blocking' as const,
-      code: 'dependency-unregistered',
-      ...(where ? { frond: where.frond } : {}),
-      subject,
-      filePath: where?.filePath ?? '',
-      message: `${subject} asks for ${missing}, and nothing ${where ? `in frond '${where.frond}' or above it ` : ''}answers that name. `
-        + `A class of that name in a convention directory, or one extending it, would.`,
-    }];
-  });
+  return [...refused.values()];
 }

package/src/contract.ts

@@ -53,6 +53,9 @@ export type { DeclaredEdge } from './wire/topology/DeclaredEdge.js';
 export type { DeclaredFrond } from './wire/topology/DeclaredFrond.js';
 export type { DeclaredTopology } from './wire/topology/DeclaredTopology.js';
 export type { Edge } from './wire/topology/Edge.js';
+export { OPERATION_KINDS, type OperationKind } from './wire/OperationKind.js';
+export { CARDINALITIES, type Cardinality } from './wire/Cardinality.js';
+export { PLACEMENTS, type Placement } from './wire/Placement.js';
 export type { FrondPlacement } from './wire/topology/FrondPlacement.js';
 export type { TopologyReport } from './wire/topology/TopologyReport.js';
 export { assertIdentityCard } from './wire/card/IdentityCard.js';

package/src/descriptor/CollectorEntry.ts

@@ -1,11 +1,6 @@
+import type { Subject } from './Subject.js';
 /** A discovered collector (resolves handler input params from invocation context). */
-export interface CollectorEntry {
+export interface CollectorEntry extends Subject {
   /** Registration key of the TYPE this collector resolves — 'user', 'ability'. */
   typeName: string;
-  /** The collector class. */
-  ctor: new (...args: never[]) => unknown;
-  /** Constructor dependency type names (from AST scan). */
-  deps: string[];
-  /** Absolute file path (for debugging). */
-  filePath: string;
 }

package/src/descriptor/FrondDescriptor.ts

@@ -1,4 +1,6 @@
 import type { OperationContract } from '../wire/OperationContract.js';
+import type { OperationOverride } from '../OperationOverride.js';
+import type { FrondConfig } from '../FrondConfig.js';
 import type { ProviderEntry } from './ProviderEntry.js';
 import type { EntityEntry } from './EntityEntry.js';
 import type { HandlerEntry } from './HandlerEntry.js';
@@ -15,7 +17,7 @@ import type { ExtensionEntry } from './ExtensionEntry.js';
  */
 export const nameOf = (provider: ProviderEntry): string => provider.name ?? provider.ctor.name;
 
-export interface FrondDescriptor {
+export interface FrondDescriptor extends Pick<FrondConfig, 'pipes' | 'surfaces' | 'reads'> {
   name: string;
   source: FrondSource;
   providers: ProviderEntry[];
@@ -41,26 +43,10 @@ export interface FrondDescriptor {
    * flat, and a directory says nothing about who shares its code.
    */
   extends?: string;
-  /** The ops that finish a fact, in order — see `FrondConfig.pipes`. */
-  pipes?: Record<string, string[]>;
-  /**
-   * Per-surface entity lists from frond.config.ts (e.g. { graphql: ['Post'], rest: ['Post',
-   * 'Author'] }).
-   */
-  surfaces?: Record<string, string[]>;
-  /** Entities this frond may read across sources — see `FrondConfig.reads`. */
-  reads?: string[];
   /** Per-operation overrides from frond.config.ts. */
-  operationsOverrides?: Record<string, OperationContract & {
-    kind?: 'query' | 'command';
-    /** Class name to resolve from DI (overrides default `{Entity}Handler` lookup). */
+  operationsOverrides?: Record<string, OperationContract & Omit<OperationOverride, 'handler'> & {
+    /** The handler CLASS of `frond.config.ts`, by the name DI resolves it under. */
     handlerName?: string;
-    /** Method name on the resolved handler (defaults to op name). */
-    method?: string;
-    /** The GraphQL root field this op answers to — read by `adapter/graphql`. */
-    graphql?: string;
-    /** Where it answers over REST — read by `adapter/rest`, the dual of `graphql`. */
-    rest?: { method?: string; path?: string; status?: number };
   }>;
 }
 

package/src/descriptor/HandlerEntry.ts

@@ -1,8 +1,9 @@
+import type { Subject } from './Subject.js';
 import type { SchemaView } from '@fougere/schema';
 import type { OperationsMap } from '../wire/OperationsMap.js';
 
 /** A discovered handler (controls what a service exposes). */
-export interface HandlerEntry {
+export interface HandlerEntry extends Subject {
   /** Registration key (e.g. 'postHandler'). */
   name: string;
   /**
@@ -10,14 +11,8 @@ export interface HandlerEntry {
    * `post`).
    */
   address: string;
-  /** The handler class. */
-  ctor: new (...args: never[]) => unknown;
   /** All operations with full signatures for binding. */
   operations: OperationsMap;
-  /** Constructor dependency type names (from AST scan). */
-  deps: string[];
-  /** Absolute file path (for debugging). */
-  filePath: string;
   /** Whether this handler is part of the frond's public contract. */
   exposed?: boolean;
   /** Output schema override — when Crud(Entity, Output), restricts storage output. */

package/src/descriptor/MiddlewareEntry.ts

@@ -1,3 +1,4 @@
+import type { Subject } from './Subject.js';
 /**
  * A discovered middleware — a class declaring `around(ctx, next)`, which runs before and after
  * every operation of its frond, and of the fronds that inherit from it.
@@ -5,13 +6,7 @@
  * How far it reaches is not written here: it is where the frond sits in `FougereConfig.fronds`,
  * and stating it twice would put one decision in two places.
  */
-export interface MiddlewareEntry {
+export interface MiddlewareEntry extends Subject {
   /** Class name — the key it registers under in its frond's scope. */
   name: string;
-  /** The middleware class. */
-  ctor: new (...args: never[]) => unknown;
-  /** Constructor dependency type names (from AST scan). */
-  deps: string[];
-  /** Absolute file path (for debugging). */
-  filePath: string;
 }

package/src/descriptor/PresenterEntry.ts

@@ -1,12 +1,11 @@
+import type { Subject } from './Subject.js';
 import type { PresenterViews } from '../prefab/presenter.js';
 import type { PresenterFieldMeta } from './PresenterFieldMeta.js';
 
 /** A discovered presenter (computed fields for an entity's output). */
-export interface PresenterEntry {
+export interface PresenterEntry extends Subject {
   /** Entity name this presenter enriches (e.g. 'post' from PostPresenter). */
   entityName: string;
-  /** The presenter class. */
-  ctor: new (...args: never[]) => unknown;
   /** Computed field names (method names on prototype). */
   fields: string[];
   /** Per-field type metadata (inferred from source via parser). */
@@ -16,8 +15,4 @@ export interface PresenterEntry {
    * items: [OrderItemView] })`).
    */
   views?: PresenterViews;
-  /** Constructor dependency type names (from AST scan). */
-  deps: string[];
-  /** Absolute file path (for debugging). */
-  filePath: string;
 }

package/src/descriptor/ProviderEntry.ts

@@ -1,5 +1,6 @@
+import type { Subject } from './Subject.js';
 /** A discovered provider — a class under `services/` or `repositories/`, injected by type. */
-export interface ProviderEntry {
+export interface ProviderEntry extends Subject {
   /**
    * The container key — the class name as the SOURCE spells it.
    *
@@ -9,12 +10,6 @@ export interface ProviderEntry {
    * A name a tool may rewrite is written down, for the same reason `deps` is.
    */
   name?: string;
-  /** The class constructor (default export of the file). */
-  ctor: new (...args: never[]) => unknown;
-  /** Constructor dependency type names (from AST scan). */
-  deps: string[];
-  /** Absolute file path (for debugging). */
-  filePath: string;
   /**
    * What the source said and the runtime erased: a port, which a class below answers for and
    * nothing may instantiate — never a candidate for the ports above it.

package/src/descriptor/Subject.ts

@@ -0,0 +1,10 @@
+import type { Ctor } from '../Ctor.js';
+
+/** A class the boot builds — what its constructor asks for, and where the scan found it. */
+export interface Subject {
+  ctor: Ctor;
+  /** Constructor dependency type names (from AST scan). */
+  deps: string[];
+  /** Absolute file path (for debugging). */
+  filePath: string;
+}

package/src/descriptor/index.ts

@@ -21,6 +21,7 @@ export { type OperationsMap } from '../wire/OperationsMap.js';
 export { type Param } from '../wire/Param.js';
 export { type TypeRef } from '../wire/TypeRef.js';
 export { computeBindingPlan, type BindingPlan } from '../wire/binding.js';
+export { opsOf } from '../prefab/opsOf.js';
 export type { Signature } from '../wire/Signature.js';
 export { awaitKeyOf, emitKeyOf } from '../wire/Emit.js';
 export { addressOf } from '../wire/Facade.js';

package/src/diagnostic.ts

@@ -1,3 +1,5 @@
+import { BootRefusal } from './BootRefusal.js';
+
 /**
  * One thing that does not hold, in the terms of whoever has to fix it — raised by the scan,
  * by a boot rule, or by `fougere check`, which is why it belongs to no phase.
@@ -30,12 +32,12 @@ export interface Diagnostic {
  * Every blocking diagnostic in ONE refusal, so a boot names all of them rather than the
  * first — the shape `fougere check` renders, read back by whoever has to fix it.
  */
-export function refusalOf(diagnostics: readonly Diagnostic[], what: string): Error | undefined {
+export function refusalOf(diagnostics: readonly Diagnostic[], what: string): BootRefusal | undefined {
   const blocking = diagnostics.filter((one) => one.severity === 'blocking');
   if (blocking.length === 0) return undefined;
 
   const lines = blocking.map((one) =>
     `  [${one.code}]${one.subject ? ` ${one.subject}` : ''}\n    ${one.message}\n    ${one.filePath}`);
 
-  return new Error(`Fougere boot refused: ${blocking.length} ${what}:\n${lines.join('\n')}`);
+  return new BootRefusal(`Fougere boot refused: ${blocking.length} ${what}:\n${lines.join('\n')}`);
 }

package/src/dispatch/ArgumentResolver.ts

@@ -1,15 +1,21 @@
+import { FieldValueValidator, type SchemaView } from '@fougere/schema';
 import type { InvocationContext } from '../wire/InvocationContext.js';
 import type { BindingPlan } from '../wire/binding.js';
 import { ErrorCode } from '../wire/ErrorCode.js';
 import { FougereError } from '../wire/FougereError.js';
 import type { CollectorLookup } from './CollectorLookup.js';
+import type { EntityLookup } from './EntityLookup.js';
 import { collectedAs } from '../prefab/collector.js';
+import { validateInput } from './validateInput.js';
 
 type ParamSource = Extract<BindingPlan[number]['source'], { kind: 'param' }>;
 
 /** Resolves an operation's declared binding plan against one invocation. */
 export class ArgumentResolver {
-  constructor(private readonly collectors?: CollectorLookup) {}
+  constructor(
+    private readonly collectors?: CollectorLookup,
+    private readonly entities?: EntityLookup,
+  ) {}
 
   async resolve(plan: BindingPlan, ctx: InvocationContext): Promise<unknown[]> {
     const args: unknown[] = [];
@@ -26,7 +32,7 @@ export class ArgumentResolver {
           break;
         }
         case 'param': {
-          args.push(ArgumentResolver.param(binding.source, binding.optional, ctx));
+          args.push(this.judged(binding.source, ArgumentResolver.param(binding.source, binding.optional, ctx)));
           break;
         }
         case 'fact':
@@ -56,6 +62,39 @@ export class ArgumentResolver {
     return args;
   }
 
+  /**
+   * The arguments code wrote, judged where a door would have judged them: the input against
+   * the op's view, a value a collector would have produced through that collector's entity —
+   * which also puts back a `Date` that crossed a wire as text. Nothing is collected: what the
+   * caller left out stays out.
+   */
+  given(plan: BindingPlan, input: SchemaView | undefined, ctx: InvocationContext): unknown[] {
+    const args = ctx.args ?? [];
+
+    return plan.map((binding, index) => {
+      const value = args[index];
+      switch (binding.source.kind) {
+        case 'context':
+          return ctx;
+        case 'input':
+        case 'fact':
+        case 'pipe':
+          return validateInput(input, { ...ctx, input: value }).input;
+        case 'collector': {
+          const collector = this.collectors?.(binding.source.typeName);
+
+          return collector ? collectedAs(collector, value) : value;
+        }
+        case 'param':
+          if (value === undefined && !binding.optional) throw refused(binding.source.name, 'Required');
+
+          return this.judged(binding.source, value);
+        case 'query':
+          return value;
+      }
+    });
+  }
+
   /**
    * A value the caller typed in a path or a query string. `null` is a value, not a miss: only
    * `undefined` means absent, so `T | null` stays apart from `T | undefined`.
@@ -77,6 +116,19 @@ export class ArgumentResolver {
     return coerced;
   }
 
+  /** `age: Sample['age']` obeys what `Sample.age` declares, after the query string was read. */
+  private judged(source: ParamSource, value: unknown): unknown {
+    if (value === undefined || !source.field) return value;
+
+    const field = this.entities?.(source.field.entity)?.getFields()[source.field.name];
+    if (!field) return value;
+
+    const verdict = FieldValueValidator.of(field).parse(value);
+    if ('message' in verdict) throw refused(source.name, verdict.message);
+
+    return verdict.value;
+  }
+
   private static number(value: unknown): number | undefined {
     if (typeof value === 'number') return Number.isNaN(value) ? undefined : value;
     if (typeof value !== 'string' || value.trim() === '') return undefined;

package/src/dispatch/EntityLookup.ts

@@ -0,0 +1,4 @@
+import type { SchemaView } from '@fougere/schema';
+
+/** An entity this process knows, by the name a type wrote — `Post` in `Post['id']`. */
+export type EntityLookup = (name: string) => SchemaView | undefined;